HP Secure Encryption manual Security domains, Deployment scenarios

Page 14

unencrypted when accessed from the host system and placed on tape. Software or hardware utilizing an independent encryption feature is not impacted by HP Secure Encryption.

Security domains

A security domain is a blueprint for separating out different groups of servers or key management escrows where access to a set of keys is inhibited by the structure of the various domains. The best mechanisms for establishing separate security domains are either through the use of separate HP ESKM or via the use of groups within the HP ESKM. Unique groups provide a software mechanism for each server to partition off their key sets from one server to another. Groups are created on the HP ESKM and assigned to a server via the HP iLO Key Manager page. For more information, see "Remote Key Management Mode (on page 17)."

Deployment scenarios

Remote and local key management requirements

Use the table below to determine which encryption mode is right for you.

Mode parameters	Local Key Management Mode	Remote Key Management Mode

Number of servers	<99 (recommended)	100 or more
Support of HP ESKM by customer	No	Yes
Utilize Integrated Lights Out (iLO)	No	Yes
Advanced or Scale Out License in the
infrastructure
Requirement to escrow keys	No	Yes
Manual tracking of keys	Yes	No
Poor or no network connectivity to HP	Yes	No
ESKM

Planning 14

Image 14

Contents HP Secure Encryption Installation and User Guide Page Contents Support and other resources Overview About HP Secure EncryptionEncryption features BenefitsFeature Description Eskm HP ProLiant servers Solution componentsHP Smart Storage Administrator HP iLO HP Smart Array ControllerHP SmartCache Minimum requirements HP Enterprise Secure Key Manager 3.1 and later HP Eskm and key managementLicensing Encrypted backups Encryption setup guidelinesRecommended security settings at remote sites PlanningRemote and local key management requirements Security domainsDeployment scenarios Configuring the controller local mode ConfigurationLocal key management mode Configuration Remote Key Management Mode Configuring Remote Key Management ModeAdding a user Configuring the HP EskmLogging in to the HP Eskm Configuration Adding a group Assigning a user to a group Configuration Configuration Creating a Master Key Placing a key in a group Running a key queryConfiguration Assigning a key to a group Configuring HP iLO Connecting HP iLO to HP Eskm Configuration Configuring the controller remote mode Configuration Opening Encryption Manager Accessing Encryption ManagerOperations Logging into Encryption ManagerManaging passwords Set or change the Crypto Officer passwordSet or change the password recovery question Set or change user account passwordSet or change the controller password Suspending the controller password Resuming the controller password Rekeying the Drive Encryption Keys Working with keysChanging the Master Encryption Key Creating a plaintext volume Rescanning keysOperations Operations Converting plaintext volumes into encrypted volumes Changing key management modes Enabling/disabling plaintext volumes Enabling/disabling the firmware lock Enabling/disabling local key cache Importing drive sets in Local Key Management Mode Importing drives with different Master KeysOperations Maintenance ControllersReplacing a physical drive DrivesFlashing firmware Encryption ManagerQuery by drive serial number GroupsLocating groups associated with a drive Maintenance Query by previous server name Maintenance Displaying log information Running queries Maintenance Maintenance Maintenance Lost or forgotten Crypto Officer password TroubleshootingCommon issues Lost or forgotten controller passwordLocating the key using the HP Eskm Local modeRemote mode Lost or forgotten Master KeyLocating the key using iLO Forgotten which Master key goes with which drive Logical drives remain offline Master key not exportingTesting the connection between HP iLO and the HP Eskm Potential errors encountered Error Description Action Clearing the encryption configuration HP contact information Support and other resourcesBefore you contact HP Appendix Encryption algorithmsGlossary Master Encryption Key ILOLocal Master Encryption Key PlaintextVolume encryption key Remote Key ManagerDocumentation feedback Index EskmIndex